CI/CD
Browse all articles, tutorials, and guides about CI/CD
Posts
Your Trace Dies the Moment the Pipeline Shells Out
OpenTelemetry has a Release Candidate spec for passing trace context through environment variables, which is how you connect a CI run to the build tool it spawns. Two runnable demos: one showing four orphaned traces becoming one, and one showing why BAGGAGE across a trust boundary is the part worth arguing about.
systemd and NetworkManager Are Trapping AI Agents
Both projects now plant instructions in their repos designed to make an unreviewed AI contribution give itself away. I ran a real agent against each to see what fires, what does not, and what walks straight past.
Gate Your Terraform Plans: Rules Decide, the Model Explains
A pull request says "3 to add, 1 to change, 1 to destroy" and everyone approves it. This is a GitHub Action that reads the plan JSON, fails the job on selected changes that risk data loss or public exposure, and uses DigitalOcean inference only to write the comment. Measured against twenty labelled plans, including the four it misses.
Who Owns the State File, and Other Questions That Decide Your Week
Most Terraform pain is not HCL. It is state: who is allowed to write it, how it is split, how you find out it no longer matches reality, and how a plan gets reviewed before it applies. Four decisions, a real drift run, and the tooling that exists for each.
The 9 Types of API Testing, and Where Each Belongs in Your Pipeline
Telling load testing from stress testing is easy. What shapes delivery is which of the nine run on every pull request, and which only run after a deploy.
You Cannot Rotate a Secret You Cannot Find
Trace one credential from a laptop to production and count the copies it leaves behind. That count is your rotation cost and your blast radius, and it is why most teams never rotate anything.
What Does One Merge Actually Cost You in CI?
Wall-clock time and machine minutes are different numbers, and most teams track only one. Here is how to get both from your own repo.
Stacked Pull Requests on GitHub: What They Actually Fix
GitHub shipped stacked pull requests to public preview. What stacking solves, how the gh-stack workflow works, and when a stack is the wrong shape.
Explaining CI Failures Automatically with a GitHub Action
We built a GitHub Action that reads a failing job log and tells you what broke, using DigitalOcean serverless inference. The interesting part was not the model call. It was throwing away 92% of the log before sending it.
One git push to RCE: the anatomy of CVE-2026-3854 and the parsing bug behind it
A single git push could execute code on GitHub's backend, with cross-tenant reach on github.com itself. The root cause is a bug you almost certainly have somewhere too: untrusted input smuggled through a delimited internal header.
The pwn request just got harder: what actions/checkout v7 changes, and what it does not
GitHub is backporting a fork-checkout block to actions/checkout, with enforcement on July 20, 2026. Here is what a pwn request actually is, what the change stops, and the three ways your pipeline is still exposed after you upgrade.
Your GitOps Controller Is Tier Zero: the Argo CD repo-server RCE
An unauthenticated RCE in Argo CD's repo-server turns one compromised pod into full cluster takeover. Reported 18 months ago, still unpatched. Here is how it works and the one control that stops it.
Shai-Hulud Reaches PyPI: The Hades Wave That Runs Before You Import It
The Shai-Hulud worm jumped to PyPI on June 7. The Hades wave hides in 19 Python packages, runs at interpreter startup through a .pth hook before you import anything, and steals your CI/CD secrets.
node-ipc DNS-Tunneling Supply Chain Attack: Your Egress Firewall Probably Missed This
On May 14, 2026, three malicious versions of the node-ipc npm package shipped a payload that hunts AWS, SSH, kubeconfig, and GitHub CLI credentials, then smuggles them out through DNS TXT queries. Most orgs filter HTTPS egress. Almost nobody filters DNS. Here is what the payload does and how to close the gap.
AntV npm Compromise: The Shai-Hulud Worm Comes for Your Dashboards (May 19, 2026)
A new Shai-Hulud wave landed at 01:56 UTC on May 19 and rode the @antv maintainer account through 323 packages including echarts-for-react. Here is what got published, what it steals, and the lockfile grep that tells you if you are exposed.
TanStack npm Worm: The Supply-Chain Attack With a Dead-Man's Switch
On May 11, 2026, attackers republished 14+ official TanStack packages on npm with a worm that signs itself with valid SLSA provenance and arms a dead-man's switch that wipes your home directory the moment you revoke the stolen GitHub token. Here is what happened, how the payload works, and how to check your machine.
Claude Code Source Leaked via npm Source Maps: Lessons for Every DevOps Team
Anthropic accidentally shipped source maps in their npm package, exposing 512,000 lines of Claude Code source. Here is what went wrong and how to prevent it in your own CI/CD pipeline.
The Axios Supply Chain Attack: What DevOps Teams Need to Know
A compromised npm maintainer account led to malicious axios versions deploying a RAT across macOS, Windows, and Linux. Here is what happened, how to check if you are affected, and how to prevent this in your pipeline.
How to Implement Progressive Delivery with Feature Flags
Learn how to implement progressive delivery using feature flags, canary releases, and gradual rollouts to ship changes safely in production without risking your entire user base.
GitOps: Deploy Docker Containers with GitHub Actions and ArgoCD
Learn how to implement a modern GitOps workflow for Docker deployments. This guide covers building images with GitHub Actions, pushing to container registries, and automated deployments with ArgoCD.
Introduction to ArgoCD: Getting Started with GitOps
Learn how ArgoCD brings GitOps principles to Kubernetes deployments. This hands-on guide covers core concepts, architecture, and practical examples to get you started with declarative, automated application delivery.
Deployment Strategies: Blue-Green, Canary, and Rolling Deployments Explained
Learn how to deploy applications safely using blue-green, canary, and rolling deployment strategies. Understand the theory, trade-offs, and decision-making behind each approach.
The Hidden Costs of Over-Automation in DevOps
Automation speeds things up, but too much of it can hide failures, slow incident response, and add fragile layers you have to maintain.
Why Your CI/CD Pipeline Is Slower Than It Should Be (and How to Fix It)
Small pipeline changes give big wins. Parallelize jobs, cache dependencies, pin images, reuse build artifacts, and run only the tests you need.
How to Save Terraform Plan and Apply Output to a File
Learn how to save Terraform plan output for review, share readable apply logs, and use the -out flag for safe two-step deployments.
CI/CD Pipeline Hardening: A Practical Guide to Securing Your Build Infrastructure
Your CI/CD pipeline has access to source code, secrets, and production environments. Here is how to harden it against supply chain attacks, secret exfiltration, and artifact tampering.